There is a reason the gas-station app on your phone is free. Nothing about it is free. You just are not paying with money.

The pitch is simple enough. Download Upside, claim an offer, fill your tank, and get a few cents back per gallon. Groceries, restaurants, the same deal. The app costs nothing to download, carries no subscription fee, and no membership cost (Upside's own words) (3). Who would turn that down?

I would, and after you see how the machine actually works, you might too. I have spent a lot of years digging into things the mainstream would rather you not look at too closely, and this one is hiding in plain sight on your home screen.

Upside is not alone, either. GasBuddy, Fetch, Drop, and CheckPoints all run some version of the same play: a free app, a little cash back, and your location switched on (11, 6). The mainstream narrative is that these are just friendly little tools to help you save money. The truth is a rabbit hole, and once you start down it, the app on your home screen never looks the same.

The App That Makes Money When You Spend Money

Let me be clear about what Upside is, because the company is not hiding it. Upside is a cash-back app for gas, groceries, and dining, and it is free for consumers to use (3). The money does not come from you, at least not directly. It comes from retailers.

Here is the mechanism. Upside makes its money when it brings new business to participating retailers, not from charging consumers fees. When Upside helps drive customers to a merchant's location, that merchant shares part of the value back as cash-back offers (3). In plain terms, Upside is a performance-marketing engine. Retailers pay it to move bodies through their doors, and Upside hands you a sliver of that payment to keep you coming back.

The sliver is the part worth sitting with. Third-party analysts put Upside's affiliate commissions as high as roughly 20 percent across a network of more than 30,000 partners, plus white-label software deals with names like Lyft, Uber, GasBuddy, and Current (11). The company raised money in April 2022 at a reported $1.5 billion valuation (11). Its users have earned more than $300 million in cash back over the years, while its merchant partners have generated more than $700 million in profit (11).

Read those two numbers again. You, collectively, got $300 million. The merchants, collectively, got $700 million. And the company in the middle is worth a billion and a half dollars. You are the smallest line item in your own transaction.

What You Hand Over to Save a Few Cents

So what does Upside get out of you that is worth a $1.5 billion valuation? The answer is in its privacy policy, and it is worth reading slowly.

Upside collects your location, if you let it. It collects your purchase and transaction history, the date and time of your transactions, the site identifiers, the transaction totals, and the first six and last four digits of whatever card you used (1). It collects your device's advertising ID, the little persistent identifier that lets ad networks recognize your phone across apps and websites (1).

And here is the part most people never notice. The first time you redeem an offer, you authorize participating merchants to send your purchase history to Upside (1). You are not just telling Upside what you bought. You are opening a pipe from the store's register to the app, and that pipe stays open.

None of this is hidden. It is all disclosed, in a privacy policy almost nobody reads. That is the whole trick of surveillance capitalism. It does not need to be secret. It just needs to be boring.

"We Don't Sell Your Data" Is Not the Same as "We Don't Monetize It"

Now I want to be fair, because fairness is what separates a real investigation from a hit piece. Upside states plainly that it does not sell app users' personal information or retailers' transaction data (2). I have no source that contradicts that, and I am not going to pretend I do.

But "we don't sell your data" is a very specific sentence, and it leaves a lot of room.

Upside's own privacy policy discloses that it shares personal data with advertising networks and data-analytics providers (1). It discloses that it shares information about its users with advertising partners to enable interest-based advertising, and to reach "lookalike audiences" on other online platforms (1). A lookalike audience is exactly what it sounds like: the ad platforms take what they know about Upside's users, find other people who behave the same way, and sell ads against that pattern.

You do not have to sell data to monetize it. You can rent out the pattern. You can let an ad network read the shape of your users and charge advertisers to aim at people who look like them. The data never changes hands in a way that trips the word "sold," and the money still flows. This is the load-bearing fact of the whole business model, and it comes straight from Upside's own policy, not from a critic.

The Cash Back Is the Bait

So let me put the two halves together.

On one side, you get a few cents back per gallon, a couple of dollars on a tank, maybe a few dollars a month if you use the app religiously. On the other side, Upside holds a continuous, timestamped record of where you go and what you buy, tied to a persistent advertising ID, and it shares the behavioral pattern with ad networks to aim targeted and lookalike advertising at you and at people who resemble you.

The cash back is not the product. The cash back is the bait. The behavioral data is the product, and you are the one producing it, for free, in exchange for pennies.

I do not know the exact dollar value of your location data, and I am not going to invent a number for you. Nobody in this business publishes a clean per-user price tag, and anyone who quotes you one is guessing. But I do not need a number to see the asymmetry. A company does not reach a $1.5 billion valuation by giving away more than it takes in.

The FTC Has a Name for This

The Federal Trade Commission has a name for the business of collecting, analyzing, and profiting from information about people. It calls it commercial surveillance (10). Not "data sharing." Not "personalization." Surveillance.

That word matters, because it reframes the whole transaction. When you open a cash-back app, you are not getting a discount. You are enrolling in a surveillance program that pays you a small stipend for your participation.

And the FTC has spent the last few years documenting, in public filings, exactly what the surrounding industry does with the data that apps like this feed into.

The Location Brokers the FTC Keeps Catching

Here is where the story gets uncomfortable, and it is worth naming the companies one by one, because the FTC already has.

Kochava sold geolocation data from hundreds of millions of mobile devices, and the FTC alleged that a single week of its data covered more than 61 million unique devices, precise and timestamped, traceable to reproductive health clinics, places of worship, homeless and domestic violence shelters, and addiction recovery centers (4).

X-Mode Social, later Outlogic, sold raw location data tied to mobile advertising IDs, and the FTC said that data was not anonymized and could be matched to an individual's device and the places they visited. The buyers included hundreds of clients across real estate and finance, and private government contractors (5). The FTC's first settlement with a data broker over sensitive location data banned the practice outright (5).

InMarket built nearly 2,000 audience segments from location histories, with names like "parents of preschoolers," "Christian church goers," and "wealthy and not healthy," and was banned from selling precise location data (6). Keep in mind, InMarket ran its own shopping-rewards app, CheckPoints, which is the same cash-back-for-your-location frame as Upside (6).

Gravy Analytics and Venntel claimed to process more than 17 billion signals from around a billion mobile devices every single day, and the FTC alleged they used geofencing, drawing a virtual boundary around a place, to build and sell lists of consumers who attended medical events and places of worship (7).

Mobilewalla harvested location data straight out of real-time bidding, the ad-auction system that runs behind almost every app you use, collecting more than 500 million unique advertising identifiers paired with precise location between January 2018 and June 2020, and built audience segments that included one targeting women who visited pregnancy centers (8).

And Flo Health, a fertility-tracking app, shared sensitive health data from millions of users with marketing and analytics firms including Facebook and Google, despite promising to keep it private (9).

That is six separate enforcement actions, all public, all about the same underlying machine: free consumer apps collect your location and behavior, and the data flows into an ad-tech ecosystem that has repeatedly been caught selling raw, re-identifiable location data to whoever will pay.

How the Data Actually Flows

Let me explain the plumbing, because "they're watching you" is a slogan, and slogans do not change behavior. The mechanism does.

It starts with the advertising ID. Almost every app on your phone carries one, a persistent identifier that lets ad networks recognize your device as it moves between apps and websites (5). When you enable location services, the app can attach your coordinates to that ID.

Then there is the SDK, the software development kit, a chunk of code the app embeds so an ad network or data broker can collect signals directly. The FTC's X-Mode action describes exactly this: raw location data associated with mobile advertising IDs, sold onward (5).

Then there is real-time bidding. When an ad slot opens up in an app, an auction runs in milliseconds, and in that auction, data about you, including your location, can be passed to bidders. Mobilewalla pulled more than 500 million advertising identifiers paired with precise location out of that auction stream (8).

Then there is geofencing. A broker draws a virtual boundary around a physical place, a clinic, a church, a recovery center, and logs every device that crosses it. Gravy Analytics used exactly this to build lists of people who attended medical events and places of worship (7).

And finally there is the audience segment. All of that raw movement gets sorted into buckets, "parents of preschoolers," "wealthy and not healthy," women who visited pregnancy centers, and those buckets are sold to advertisers (6, 8).

None of this requires your name. It requires your pattern, and your pattern is enough.

The Lie of "Anonymized"

The industry's favorite word is "anonymized," and the FTC has been blunt about what that word is worth. Location data is not anonymized. It is capable of matching an individual's device to the places they visited (5). The FTC alleged that by selling data tracking people, Kochava was enabling others to identify individuals and exposing them to threats of stigma, stalking, discrimination, job loss, and even physical violence (4).

Think about what that means in practice. You do not need a name to find the person who visits a particular house every night, or a particular clinic every month. You need a device ID and a map, and the map is for sale.

I do not know the answer to why we, as a culture, decided that a few cents back per gallon was a fair trade for that. But it sure seems like we made the trade before we understood what we were handing over.

The Honest Spine of the Whole Thing

So here is the truth, stripped down.

Cash-back apps are not free. You pay with a continuous feed of your location and your purchase history. The app monetizes that feed through targeted advertising and lookalike-audience sharing, which its own privacy policy discloses (1). And that feed sits inside a location-data-broker industry the FTC has repeatedly caught selling raw, re-identifiable location data to advertisers, finance firms, and government contractors (4, 5, 6, 7, 8).

The cash back is the bait. The behavioral data is the product. And the person who ends up paying the real price is the one who thought they were getting a discount.

Of course, none of this means you have to delete the app tonight. It means you should know what the trade actually is, and make it with your eyes open. After all, the one thing surveillance capitalism cannot survive is a customer who reads the fine print.

References

1. Upside Services, Inc. "Privacy Policy." Last updated February 4, 2026. https://www.upside.com/data-and-security/privacy-policy

2. Upside Services, Inc. "Data & Security." https://www.upside.com/data-and-security

3. Upside Services, Inc. "How does Upside make money?" Upside blog. https://www.upside.com/blog/how-does-upside-make-money

4. Federal Trade Commission. "FTC Sues Kochava for Selling Data that Tracks People at Reproductive Health Clinics, Places of Worship, and Other Sensitive Locations." August 29, 2022. https://www.ftc.gov/news-events/news/press-releases/2022/08/ftc-sues-kochava-selling-data-tracks-people-reproductive-health-clinics-places-worship-other

5. Federal Trade Commission. "FTC Order Prohibits Data Broker X-Mode Social and Outlogic from Selling Sensitive Location Data." January 2024. https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-order-prohibits-data-broker-x-mode-social-outlogic-selling-sensitive-location-data

6. Federal Trade Commission. "FTC Order Will Ban InMarket from Selling Precise Consumer Location Data." January 2024. https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-order-will-ban-inmarket-selling-precise-consumer-location-data

7. Federal Trade Commission. "FTC Takes Action Against Gravy Analytics, Venntel for Unlawfully Selling Location Data Tracking Consumers to Sensitive Sites." December 3, 2024. https://www.ftc.gov/news-events/news/press-releases/2024/12/ftc-takes-action-against-gravy-analytics-venntel-unlawfully-selling-location-data-tracking-consumers

8. Federal Trade Commission. "FTC Takes Action Against Mobilewalla for Collecting and Selling Sensitive Location Data." December 3, 2024. https://www.ftc.gov/news-events/news/press-releases/2024/12/ftc-takes-action-against-mobilewalla-collecting-selling-sensitive-location-data

9. Federal Trade Commission. "FTC Finalizes Order with Flo Health, a Fertility-Tracking App that Shared Sensitive Health Data with Facebook, Google, and Others." June 2021. https://www.ftc.gov/news-events/news/press-releases/2021/06/ftc-finalizes-order-flo-health-fertility-tracking-app-shared-sensitive-health-data-facebook-google

10. Federal Trade Commission. "FTC Explores Rules Cracking Down on Commercial Surveillance and Lax Data Security Practices." August 11, 2022. https://www.ftc.gov/news-events/news/press-releases/2022/08/ftc-explores-rules-cracking-down-commercial-surveillance-lax-data-security-practices

11. RankRed. "How Does Upside Make Money? [2026 Business Model]." https://www.rankred.com/how-does-upside-make-money/

Disclaimer: I am not a lawyer so don't take any of this article as legal advice. I think that's pretty obvious but still sometimes worth stating the obvious. Do your own research. Follow the links and see if you agree with what I've said and make your own choices. You have the power to change your life and how you may or may not be surveilled.